We are going to investigate one of the gotchas when using base 64 encoded data with the asp.net Request.QueryString array.

If you try to extract a base64 encoded string from a query string then it will get corrupted. This is because a valid base64 encoded string will more than likely have plus + symbols it. As far as a url is concerned a plus symbol has a special meaning - it is the url encoded equivalent of the whitespace character.

This means that when you retrieve them from the Request.QueryString collection asp.net innocently performs its due diligence and url decodes the incoming string, replacing all + symbols with spaces.

If you try to decode the remaining base64 string you will get an error because its not in a valid format.

Is this going to happen to me?

One thing to note - this will only occur if you have a third party external system pass you a plain base64 encoded string without url encoding it first. If you're putting the base64 string into your query string via some asp.net code then you will not experience this particular bug.

How do I work around this?

The trick to work around this is to do a string.Replace(" ", "+") on any base64 encoded strings that have come from a QueryString before you use them.

And that's safe?

Its safe to do this because a space character is not a valid character in a base64 encoded string. Based on this fact you can be sure that if there are any space characters then you already have a broken base64 string on your hands. Doing the Replace() is not going to corrupt your data any further.